Ghost Campaign Plants 7 Malicious npm Packages to Steal Crypto
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- ReversingLabs uncovered 7 malicious npm packages — all published by the user "mikilanjillo" under names including coinbase-desktop-sdk, ai-fast-auto-trader, and react-performance-suite — that fake install progress to phish developers' sudo passwords and ultimately deploy a remote access trojan targeting crypto wallets.
- The packages use a multi-stage deception: they display fake npm install logs with random delays, then claim a missing write-permission error to "/usr/local/lib/node_modules" to trick users into entering their root or admin password, per researcher Lucija Valentić.
- Once a password is captured, the malware fetches a next-stage downloader from a Telegram channel, which retrieves the URL and decryption key for a final RAT payload capable of stealing browser credentials, SSH keys, cloud configurations, and developer tool tokens.
- The activity overlaps with the GhostClaw campaign documented by JFrog, which used GitHub repositories impersonating trading bots and SDKs — some accumulating hundreds of stars — alongside AI-assisted workflows to deliver macOS credential stealers disguised as legitimate developer tools.
- Panther traced an expanded package list from the same "mikilanjillo" author, revealing a dual revenue model: primary income from credential theft routed to partner-specific Telegram bots, with stolen data stored on the Binance Smart Chain (BSC), plus secondary income from affiliate URL redirects stored in a separate BSC smart contract.
- Valentić told The Hacker News the 7 packages discovered in early February 2026 are "most likely the first wave of this campaign," with the broader tradecraft signaling a shift beyond traditional package registries into GitHub and AI-assisted development workflows.
Why it matters: The "mikilanjillo" packages — with names like coinbase-desktop-sdk and ai-fast-auto-trader — show attackers weaponizing trusted npm ecosystems by posing as legitimate developer tools, and Panther's analysis confirms stolen credentials are already being monetized in real time through partner Telegram bots and Binance Smart Chain contracts, meaning any developer who installed these packages faces immediate exposure of wallets, SSH keys, and cloud credentials.
